July 21, 2026 — Rockwell Automation has disclosed a critical flaw in its FactoryTalk Services Platform (FTSP) that lets a low‑privilege user craft a malicious JSON Web Token and impersonate any other user on the server. The vulnerability (CVE-2026-10714) affects FactoryTalk Directory 6.60, the central authentication and authorization hub for many Rockwell automation products. An attacker who already has any kind of local access—even a guest account or a compromised contractor login—could abuse the flaw to gain administrative control over FactoryTalk‑protected systems, change permissions, and potentially disrupt industrial processes. Rockwell released a fix on July 14, 2026, and CISA followed with an advisory urging all affected organizations to patch quickly.

What’s Actually Broken?

At its core, CVE-2026-10714 is a JSON Web Token (JWT) signature‑validation bypass. When FactoryTalk Services Platform uses Okta for web authentication, it receives a JWT that carries identity claims. A properly secured application verifies the token’s cryptographic signature and only accepts tokens signed with an algorithm from a server‑side allowlist. The affected FTSP component, however, does not enforce that the JWT algorithm must be RSA. An attacker can therefore set the algorithm field to “none,” forge a token with arbitrary claims, and send it to the server. The server, failing to reject the unsigned token, accepts the forged identity as legitimate.

This is CWE‑1390 (Weak Authentication), and it earned a CVSS v3.1 base score of 7.8 and a CVSS v4.0 score of 8.8—both High severity. The attack requires local access, high attack complexity, and low privileges, but its “scope change” attribute means a successful compromise can affect security boundaries beyond the vulnerable component. In short, a low‑privilege user who can reach the FTSP server can become anyone they want, including an administrator.

Who’s at Risk?

The confirmed affected product is FactoryTalk Directory within FactoryTalk Services Platform version 6.60 (which Rockwell documentation may also refer to as CPR 9 SR 16). This release underpins many Rockwell automation suites, so it lives on engineering workstations, application servers, HMI nodes, and directory servers across critical manufacturing sectors worldwide. If your plant runs FactoryTalk View, Linx, Alarms and Events, or any other FactoryTalk application, there’s a good chance FTSP 6.60 is present—often installed silently as a dependency.

The vulnerability is not remotely exploitable from the internet, but do not mistake that for a low‑risk defect. Industrial incidents frequently begin with an attacker already inside the network—via phishing, compromised credentials, remote‑support channels, or shared workstations. The “local” requirement simply means the attacker needs a login on the system; that login can be a low‑privilege account, perhaps left over from a former contractor or a generic maintenance user.

What Could an Attacker Do?

Impersonating an authorized user on the FTSP server opens the door to full configuration control. According to Rockwell’s advisory, an attacker can “obtain unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP.” In a FactoryTalk environment, the Directory acts as the trust root—defining who can access which applications, alarms, recipes, and engineering tools. A malicious actor with administrative control can:

  • Create new user accounts or elevate existing low‑privilege ones.
  • Modify permissions on HMI screens, data servers, or PLC connections.
  • Disable auditing or logging to hide their tracks.
  • Pivot to other systems that depend on the FactoryTalk Directory for authorization.

Because the attacker can create a legitimate‑looking account, the compromise can persist even after the patch is applied. A clean software update does not undo configuration changes made before the fix was installed.

How We Got Here: The JWT Verification Gap

Rockwell added Okta web authentication to FTSP to modernize identity management—a sensible move, as centralized SSO and MFA improve security in many ways. However, the integration introduced a reliance on JWTs, and the FTSP component responsible for verifying those tokens was built without an explicit algorithm allowlist. This is a well‑known JWT anti‑pattern: the server should ignore any algorithm suggestion from the token itself and only accept those it trusts. If the server instead trusts the token’s header, an attacker can simply claim the algorithm is “none” and bypass all signature checks.

This class of flaw has been documented in web application penetration testing for years, but its appearance in industrial control system software is a stark reminder that identity‑layer hardening must extend to every component that consumes tokens. Rockwell discovered the issue during internal testing; CISA reports no known public exploitation as of July 21, 2026.

How to Patch and Verify

The fix is straightforward: apply individual patch RAID 1158263, the February 2026 Patch Roll‑up, or any later validated update from Rockwell. But for industrial environments, “straightforward” doesn’t mean trivial. Follow this sequence to patch safely:

  1. Inventory every system running FTSP 6.60. Don’t rely on a software spreadsheet alone—use endpoint management tools, inspect installed programs, and check any systems that might have received the service platform as part of a larger install.
  2. Confirm whether Okta web authentication is configured. Even if you think it isn’t, treat every 6.60 Directory installation as a candidate for patching unless Rockwell explicitly excludes it.
  3. Obtain the patch through your authorized Rockwell channel. The individual patch (RAID 1158263), the February 2026 Patch Roll‑up, or a later update all contain the fix.
  4. Back up FactoryTalk Directory data, application configurations, and any related virtual machines. Ensure you have a rollback plan.
  5. Schedule a maintenance window. Test the update on a non‑production system that mirrors your production environment whenever possible.
  6. Deploy the patch, restart affected services, and validate. Check that:
    - Authorized users can authenticate normally.
    - Applications dependent on FactoryTalk Directory start and connect.
    - HMIs, alarms, and data servers function as expected.
    - No account escalation is accidentally introduced.
  7. Review privileges and configuration changes made before the patch was applied. Look for:
    - New administrator accounts or role assignments without an approved change record.
    - Modified permissions on FactoryTalk‑protected objects.
    - Changes to Okta integration settings or logging configurations.
  8. Document the new version in your asset inventory for audit and compliance.

If you cannot patch immediately, enhance your compensating controls: tighten network segmentation between IT and OT, enforce least privilege on all accounts that can reach FTSP servers, enable MFA everywhere possible, and increase log monitoring for suspicious authentication events. But understand that these are temporary measures—the only permanent solution is the patch.

What to Hunt in Your Logs

Because the vulnerability could have been exploited before you learned about it, assume a low‑privilege account may have been abused. Immediately review:

  • Authentication logs for unusual use of low‑privilege accounts performing administrative actions.
  • Creation of new users or groups outside approved change windows.
  • Modifications to FactoryTalk Directory security settings.
  • Suspicious Okta portal activity or token‑related errors.
  • Remote Desktop or jump‑host logins from unexpected sources.

If you find anomalies, treat them as a potential incident. Preserve log data and configuration snapshots before making changes, then involve your incident response team. A patch alone will not remove persistence an attacker may have already established.

The Long Game: Hardening Your Industrial Identity Layer

This vulnerability is a warning that token‑based authentication in industrial systems needs the same rigor as in enterprise IT. As more OT platforms adopt SSO, OAuth, and cloud‑connected services, every component that verifies an identity token must be robust. Take this opportunity to:

  • Audit all applications that consume JWTs or SAML assertions and verify they enforce algorithm allowlists.
  • Ensure token claims like issuer, audience, and expiration are validated.
  • Move toward just‑in‑time access and principle of least privilege across your FactoryTalk estate.
  • Segment your network so that even if an attacker gains a foothold on an engineering laptop, they cannot easily reach the central FactoryTalk Directory server.

Remember: a strong identity provider like Okta is not a substitute for a secure relying application. You must test the entire chain.

Outlook: What to Watch Next

Rockwell published its advisory (SD1786) on July 14, 2026, and CISA republished it on July 21. There have been no public exploitation reports yet, but that can change quickly once technical details circulate. Monitor both organizations’ advisory pages for revisions—additional versions might be affected, or new patches could be released. Also keep an eye on industrial‑automation security forums and your vendor’s threat‑intelligence feeds for any signs of active attacks.

More broadly, expect similar token‑validation flaws to surface in other ICS products as security researchers and vendors scrutinize modern identity integrations. The lesson from CVE-2026-10714 is clear: when trust is delegated to a piece of software, that software must earn it—by verifying, not just accepting, the credentials it receives.